## Summary
Ubiquiti UniFi Protect contains an Improper Access Control issue that can allow a network-adjacent attacker to bypass authentication for data streaming. The NVD description indicates the attacker needs network access and can exploit the flaw to obtain protected data.
## Technical Details
- Vulnerability class: CWE-284 (Improper Access Control).
- Affected component: UniFi Protect Application (as stated in the NVD description).
- Attack scenario (from NVD): a malicious actor with network access can exploit the access control weakness to bypass authentication for data streaming.
- CVSS (provided): 8.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
## Affected
- UniFi Protect versions: < 7.1.83 (as provided).
## Impact
- Confidentiality impact: C:H (high) due to unauthorized access to streaming data after authentication bypass.
- Integrity impact: I:L.
- Availability impact: A:L.
- Scope: S:U (unchanged).
## Mitigation
1. Upgrade UniFi Protect to a version at or above 7.1.83 (the only fixed/threshold version explicitly provided).
2. Restrict network access to UniFi Protect so only trusted clients can reach streaming endpoints (to reduce exposure to AV:N attackers).
3. Review access logs and streaming/session activity for anomalous unauthenticated or unexpected streaming behavior (consistent with an authentication bypass scenario).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CWE-284